Validate ZIP uploads before writing to disk

[vedayeminedi]

Before opening: make sure there is an issue tracking this work, and link it below. PRs without a linked issue may be closed without review.

Linked issue

Closes #305

What this PR does

Adds early validation for uploaded project archives in the /scan endpoint. Previously, any uploaded file was written to disk before being validated as a ZIP archive. This PR rejects non-ZIP uploads with a 415 Unsupported Media Type response before any file I/O occurs and adds a test to verify the behavior.

Type of change

• Bug fix
• New feature
• ML model / training pipeline
• Refactor (no behaviour change)
• Documentation
• Tests only

ML tier (if applicable)

• Tier 1 — Triage
• Tier 2 — Predictive
• Tier 3 — Autonomous
• Not ML-related

Stack affected

• Backend
• Frontend
• Both

---

Changes

Backend

• Added early validation for uploaded project archives.
• Rejects uploads whose filename does not end with .zip.
• Returns 415 Unsupported Media Type with a clear error message.
• Prevents non-ZIP uploads from being written to disk before validation.
• Added a regression test for non-ZIP uploads.

Frontend

• No frontend changes.

New dependencies

• None.

Database / schema changes

• None.

---

Testing

How did you test this?

• Ran the upload security test suite locally.
• Verified that non-ZIP uploads return HTTP 415.
• Confirmed all upload security tests pass (3 passed).

Checklist

• Tested locally end-to-end (upload ZIP or GitHub URL → scan → findings returned correctly)
• New ML model falls back gracefully when model file is absent (Not applicable)
• No new console.error or unhandled Python exceptions introduced
• Added or updated tests where applicable
• requirements.txt / package.json updated if new dependencies added (Not applicable)
• New model files (.pkl, .pt, etc.) are gitignored, not committed (Not applicable)

---

Anything reviewers should focus on

Please review the early validation logic to ensure non-ZIP uploads are rejected before any file is written to disk and that the added regression test covers the expected behavior.

Screenshots (if UI changed)

N/A (Backend-only changes)

[github-actions]

🎉 Thank you @vedayeminedi for submitting a Pull Request!

We're excited to review your contribution.

Before Review

✅ Ensure all CI checks pass
✅ Complete the PR template
✅ Link the related issue

⚡ Want faster reviews and contributor support?

Join our Discord community:

🔗 https://discord.gg/FcXuyw2Rs

Maintainers and mentors are active there and can help resolve blockers quickly.

Happy Contributing! 🚀

[github-actions]

✅ PR template check passed!

@arpit2006 this PR is ready for your review. 🚀